buglibffcall - foreign function call libraries - Bugs: bug #30273, Executeable stack not necessary

 
 

bug #30273: Executeable stack not necessary

Submitted by:  Christoph Egger <christoph_egger>
Submitted on:  Sun 27 Jun 2010 06:52:49 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: Bruno Haible <haible>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sat 10 Jun 2017 12:43:35 PM UTC, comment #3:

You weren't clear enough when you said "stacks marked executeable ... [have] negative impact on SELinux systems". It made me think that it would lead to errors or severe warning messages.

Actually, the effect is - and not only on SELinux systems, but on all Linux distros - that the security is reduced, because it is easier for attackers to invade a system when they can put executable instructions on the stack.

This has now been fixed in git:
http://git.savannah.gnu.org/gitweb/?p=libffcall.git;a=commit;h=f08e20fb6a6d3ae630a84dafc0ec7e0c9763ae26

Bruno Haible <haible>
Project AdministratorIn charge of this item.
Sat 11 Feb 2017 03:28:22 PM UTC, comment #2:

In two months, I haven't seen any system that would require this
.section .note.GNU-stack,"",@progbits
annotation in the .s files.

I've seen SELinux systems, e.g. CentOS 5.8, Fedora 1, Fedora 13, PowerPC64.
None had this problem.

It looks like the problem existed between ca. 2003 and 2011 in some setups but nowadays no SELinux system requires this.

Bruno Haible <haible>
Project AdministratorIn charge of this item.
Sun 27 Jun 2010 08:47:26 PM UTC, comment #1:

Hi
what does "doesn't seem to be necessary" mean?
did you build clisp with the non-stack-executable libffcall?
does "make check" in clisp work?
Thanks!

Sam Steingold <sds>
Project Administrator
Sun 27 Jun 2010 06:52:49 PM UTC, original submission:

Hi!

libavcall and libcallback have both stacks marked executeable which has negative impact on SELinux systems and doesn't seem to be necessary.

See also http://bugs.debian.org/445895 as reference

Christoph Egger <christoph_egger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by haible (Posted a comment)
  • -unavailable- added by sds (Posted a comment)
  • -unavailable- added by christoph_egger (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 10 Jun 2017 12:43:35 PM UTChaibleStatusWorks For Me=>Fixed
    Sat 11 Feb 2017 03:28:22 PM UTChaibleStatusNone=>Works For Me
      Open/ClosedOpen=>Closed
    Sun 27 Jun 2010 08:47:26 PM UTCsdsAssigned toNone=>haible

    Back to the top


    Powered by Savane 3.1-cleanup1